Comments on: Help with Tumblr API keyshttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys/
Comments on Ask MetaFilter post Help with Tumblr API keysSun, 13 Jan 2013 12:55:11 -0800Sun, 13 Jan 2013 14:42:44 -0800en-ushttp://blogs.law.harvard.edu/tech/rss60Question: Help with Tumblr API keyshttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys
When using the Tumblr API, how exactly do I get the 'access_token' and 'access_secret' keys I need to post through my account via a script. <br /><br /> Howdy. I'm trying to set up a PHP script that will let me take content I've queued up and post it at regular intervals. Problem is I don't really know what I'm doing. Here's where I am at:<br>
<br>
I have registered an app with Tumblr and saved my consumer_key and consumer_secret<br>
I have found the following <a href="https://gist.github.com/1649885">php function</a> that seems to be what I'm looking for. <br>
<br>
To use that function I need to have my 'access_token' and 'access_secret' keys. My understanding is that these keys are generated when you are logged in to tumblr and then give permission to an app to access your account. But I don't understand how to do that exactly. Basically I have a flat php script that runs off cron job and assumes you have that info already. How do I write a simple tool for my app that lets me jump through the hoop of explicitly giving my app permission and saving the resulting tokens?<br>
<br>
I see people mentioning the "3-legged oauth authentication" routine, which I strongly suspect is what I'm looking for, but I can't seem to find an explanation on how exactly to do through that simple enough that I can grok it. <br>
<br>
Anyone care to explain it in a way that could be understood by someone who's a moderately PHP literate adult, but doesn't understand much of anything else.post:ask.metafilter.com,2013:site.233049Sun, 13 Jan 2013 12:55:11 -0800JezztekPHPOauthtumblrBy: plahttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys#3375125
Those come from OAuth. Easiest way, just snoop your own session with something like Fiddler or FireBug.<br>
<br>
Less straightforward (since you'll need to modify these, but perhaps more what you want since they will work programmatically), I found about a dozen scripts to do it for Twitter (such as <a href="http://stackoverflow.com/questions/10191276/twitter-getting-user-access-token-and-access-token-secret-from-aouth-token-and-s">this</a> or <a href="http://icodesnip.com/search/click%20url/14">this</a>). You could likely adapt them for Tumblr without much effort.<br>
<br>
As for the explanation, you can always do worse than <a href="http://tools.ietf.org/html/rfc5849">going right to the spec</a>. But in this case, I found one better... An unofficial <a href="http://marktrapp.com/blog/2009/09/17/oauth-dummies">OAuth for Dummies</a> overview (no personal sleight intended). :)comment:ask.metafilter.com,2013:site.233049-3375125Sun, 13 Jan 2013 14:42:44 -0800plaBy: aparrishhttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys#3375456
I made <a href="https://gist.github.com/4527803">this script</a>, which I hope will be helpful. All you need is your consumer key and consumer secret (which you can find on the <a href="http://www.tumblr.com/oauth/apps">Tumblr API Application page</a>). It'll guide you through the process of authorizing your application, picking through the callback query string, and parsing the subsequent request to fetch the access token and access token secret.<br>
<br>
The script is written in Python. It's heavily based on <a href="https://developer.linkedin.com/documents/getting-oauth-token-python">this example from the LinkedIn developer docs</a>—they also provide a <a href="https://developer.linkedin.com/documents/getting-oauth-token-php">PHP example</a>, if you're interested in making your own tool in PHP.<br>
<br>
By way of explanation, the basic flow of OAuth v1 authentication is something like this:<br>
<br>
(1) Your application gets a "request token" from the API's request token URL, which you append to the remote service's "authorize" URL.<br>
(2) The user (in this case, you) goes to the "authorize" URL, with request token information on the URL; the remote service then displays a web page which allows the user to grant your application access to their account.<br>
(3) The remote service then redirects the user to your application's "callback URL," including an OAuth "verifier" on the query string.<br>
(4) Using a combination of the request token and the verifier string, your application can then request an <i>actual</i> access token from the remote service.<br>
<br>
The above steps don't seem all that complicated, but the difficult part is that each of those requests from your application to the remote service need to include a signature. (The "signature" in this case is basically a big hash that verifies the integrity of the request, to prevent repetition and man-in-the-middle attacks.) Generating the signature is tricky and is best left to pre-baked libraries.<br>
<br>
Also, don't feel bad for not understanding all of this on your first try—OAuth v1 is an complicated, almost rube goldbergian standard that baffles users and developers alike.comment:ask.metafilter.com,2013:site.233049-3375456Sun, 13 Jan 2013 21:01:11 -0800aparrishBy: Jezztekhttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys#3375512
Hey, thanks much for taking the time to help. I started trying to work things through with pla's links but once you posted your script aparrish I decided to try that out (which meant installing python and figuring out how to get oauth2 installed, which was kinda tricky for a newbie :)<br>
<br>
It seemed to work (in as much as it gave me two keys that look like what I'd expect), but alas my script (the one I linked to) just keeps spitting out: {"meta":{"status":401,"msg":"Not Authorized"},"response":[]} ".<br>
<br>
So I dunno if I got the keys wrong, or if something else is broken. Perhaps this is just out of my league for the time being. =\comment:ask.metafilter.com,2013:site.233049-3375512Sun, 13 Jan 2013 22:42:04 -0800JezztekBy: Jezztekhttp://ask.metafilter.com/233049/Help-with-Tumblr-API-keys#3375567
Second update. Welp, it looks like I got everything to work (I think... ). Basically I tossed out the script I has glommed on to and instead just started reading in an attempt to build the most basic version I could imagine from the bottom up instead of using a pre-made script. And what do you know, hard work actually paid off for once.<br>
<br>
Thanks again!comment:ask.metafilter.com,2013:site.233049-3375567Mon, 14 Jan 2013 02:57:45 -0800Jezztek